CVE-2026-76276
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user without admin or power roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is due to embedded source maps in production JavaScript bundles.
Risk Assessment
Exposure of source code may allow attackers to find additional vulnerabilities or sensitive application information.
Recommendation
Upgrade Splunk Enterprise to a patched version and remove or restrict access to source maps in production.
Other vulnerabilities in Splunk Enterprise
See all- CVE-2026-76285Critical
Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 contain a vulnerability related to improper adherence to coding standards. The vulnerability was internally identified and addressed in the mentioned versions.
- CVE-2026-76284Critical
Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 contain a vulnerability related to improper input neutralization. The vulnerability was internally identified and addressed in the mentioned versions.
- CVE-2026-76268Critical
Vulnerability in Splunk Enterprise before versions 10.4.3 and 10.2.7 allows an unauthenticated user with network access to the Patroni REST API on a search head cluster member to execute attacker-controlled OS commands. The interface does not require authentication for critical configuration operations.
- CVE-2026-76312Critical
In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerability is possible because the dispatch archive download path does not correctly enforce the embedded-report authorization boundary and includes sensitive session material in archived search-job data.
- CVE-2026-76311Critical
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the Splunk platform instance. The vulnerability is possible because the embedded report authorization flow does not block dispatch archive download requests before Splunk Enterprise begins sending the archive to the requester.
- CVE-2026-76310Critical
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect system integrity, including by performing administrative actions when the owner holds the "admin" Splunk role. The vulnerability is possible because embedded report access does not block Representational State Transfer (REST) API dispatch archive download requests.
- CVE-2026-20253CriticalActively exploited
In Splunk Enterprise 10.2 before 10.2.4 and 10.x before 10.0.7, an unauthenticated user can create or truncate arbitrary files via a PostgreSQL sidecar service endpoint. The endpoint lacks authentication.
- CVE-2026-76283High
Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 contain a vulnerability related to protection mechanism failure. The vulnerability was internally identified and addressed in the mentioned versions.
- CVE-2026-76282High
Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 contain a vulnerability related to improper control of a resource through its lifetime. The issue was internally identified and grouped by CWE.
- CVE-2026-76281Medium
Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 contain an improper access control vulnerability. The issue was internally identified and grouped by CWE.
Original NVD description (English source)
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production JavaScript bundles for the app contain embedded source maps that include original source code. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), Splunk Observability Cloud previews (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.4/observability/splunk-observability-cloud-previews), and Navigating Splunk Web (https://help.splunk.com/en/splunk-enterprise/search/search-tutorial/10.4/part-1-getting-started/navigating-splunk-web) in the Splunk documentation. Splunk Enterprise versions 9.4.x are not affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS